Changelog in Linux kernel 6.6.157

clocksource/drivers/armada: Unwind timer clock on init failure

clocksource/drivers/clps711x: Do not unmap clocksource MMIO

clocksource/drivers/timer-sun4i: Advertise a real minimum delta

clocksource: Unregister subsystem on device registration failure

coresight: Change syncfreq to be a u8

coresight: etm4x: fix leaked trace id

coresight: etm4x: fix underflow for usage of (nrseqstate - 1)

coresight: etm4x: fix wrong check of etm4x_sspcicrn_present()

cpufreq: imx6q: fix devres accumulation across driver rebind

cpufreq: imx6q: fix out-of-bounds write when probed more than once

cpufreq: intel_pstate: Fix setting minimum P-state at init time

cpufreq: schedutil: Fix rate limit overflow

cpufreq: schedutil: Fix self-contradictory comment in sugov_iowait_apply()

cpufreq: spear: Fix an IS_ERR() vs NULL bug in spear1340_set_cpu_rate()

cpuidle: dt_idle_genpd: kfree() the original name allocation

crypto: atmel-ecc - clean up and improve ECDH comments

crypto: atmel-ecc - reject hardware ECDH without a public key

crypto: atmel-ecc - replace min_t with min

crypto: atmel-sha204a - fix heap info leak on I2C transfer failure

crypto: hisilicon/sec2 - fix CCM algorithm long packet failure

crypto: keembay - Fix AEAD unregister count in error path

crypto: keembay - Initialize completion before requesting IRQ

crypto: keembay - publish OF module alias for OCS AES/SM4

crypto: qat - clear AES key schedule from stack

crypto: rk3288 - fail ahash requests on HASH idle timeout

crypto: sa2ul - stop probe if context pool creation fails

crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping

csky: Fix a4/a5 restoration in syscall trace path

cuse: wait for pending RCU callbacks on module exit

cxl/mbox: Break poison list loop on an empty payload

cxl/pci: Honor -EPROBE_DEFER from component register setup

cxl/pci: Store the endpoint's Component Register mappings in struct cxl_dev_state

cxl/pmem: Format the nvdimm serial number as unsigned decimal

cxl/region: Fix use-after-free in find_pos_and_ways() error path

dax: read holder_ops once in dax_holder_notify_failure()

device property: fix infinite loop in fwnode_for_each_child_node()

dm array: reject an array block whose value size is not the caller's

dm raid1: reserve space for NUL-terminator in build_constructor_string()

dm-era: fix shadowed superblock leak on take-snap failure

dm-stats: fix a crash if allocation of per-cpu data fails

dm-switch: use WRITE_ONCE() in switch_region_table_write()

dm: fix race when loading and unloading a table

dm: fix resume-vs-remove race

dmaengine: dw-edma: Clear stale requests on termination

dmaengine: dw-edma: Complete descriptors before pausing

dmaengine: dw-edma: Fix HDMA channel status register access

dmaengine: dw-edma: Initialize IRQ data before requesting IRQs

dmaengine: dw-edma: Serialize abort state updates

dmaengine: dw-edma: Serialize channel state checks

dmaengine: dw-edma: Terminate all descriptors without callbacks

dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe

dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure

dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal

dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers

driver core: soc: Unregister bus on early device registration failure

drm/amd/display: avoid divide-by-zero in __is_lut_linear()

drm/amd/display: fix division by zero in get_estimated_bw()

drm/amdgpu/gfx6: Fixup emit_cntxcntl()

drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets

drm/amdgpu/gfx6: Use PFP on the compute queues too

drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup

drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup

drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check

drm/amdgpu: check thunderbolt before switcheroo registration

drm/amdgpu: fix autosuspend cleanup during removal

drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT

drm/amdkfd: Reject zero-sized AQL queue allocations after size halving

drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure

drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure

drm/bridge: tc358767: clamp the reported AUX read size to the request

drm/gud: NUL-terminate TV mode names read from the device

drm/gud: validate TV mode names before creating enum property

drm/hibmc: Fix list of formats on the primary plane

drm/hibmc: Use drm_atomic_helper_check_plane_state()

drm/i915: Guard against NULL driver_data in i915_pci_probe()

drm/lima: call drm_mm_init() with a valid allocation range

drm/msm/a6xx: Fix stale rpmh votes after suspend

drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0)

drm/msm/dsi: Drop dev_pm_opp_set_rate(0)

drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value

drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE

drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE

drm/nouveau: Use write-combined maps for coherent

drm/omap: dsi: Do not copy isr table

drm/panel-edp: fix i2c adapter leak on probe failure

drm/panel: samsung-s6d16d0: Power off on prepare failure

drm/rockchip: vop2: Recognise 10-bit YUV422 as YUV format

drm/sun4i: crtc: Propagate layer initialization error

drm/sun4i: dw-hdmi: Drop TCON TOP port reference

drm/sun4i: fix refcount leak in sun4i_backend_init_sat()

drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz

drm/sun4i: tcon: Drop remote endpoint reference

drm/sun4i: tcon: Drop TCON TOP device reference

drm/sun4i: tcon: Set output mux for DSI and LVDS

drm/sun4i: vi scaler: Fix coefficient selection

drm/tve200: add OF module alias for autoloading

drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used

drm: fix race between partial drm_dev_register() failure and ioctl

drm: lcdif: Wait for vblank before disabling DMA

drm: Remove unused header in drm_dumb_buffers.c

eCryptfs: bound the packet-length peek to the user buffer

ecryptfs: fix tag 11 packet exact-fit size check

ecryptfs: hold msg ctx list lock when cleaning daemon queue

ecryptfs: pass packet set buffer size to parser

ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet

ecryptfs: reject too-small tag 70 packets

ecryptfs: release message context on send failure

ecryptfs: show filename encryption options

efi: fix stale reference to efi_recover_from_page_fault()

efivarfs: Rate limit statfs() handler

entry: Fix seccomp bypass after ptrace with TSYNC

erofs: Fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS default logic

eventfs: Initialize ei->children and ei->list in init_ei()

ext4: check dir entry fits before reading the hash trailer in ext4_search_dir()

ext4: clear stale xarray tags on folios skipped during writeback

ext4: drain in-flight DIO before buffered write fallback

ext4: fix buffer_head leak in ext4_init_orphan_info

ext4: fix circular lock dependency in ext4_ext_migrate

ext4: fix out-of-bounds read in ext4_read_inline_dir()

ext4: fix spurious message about orphan cleanup on RO fs

ext4: skip extra isize expansion during mount to prevent deadlock

f2fs: fix i_size when pinned fallocate partially fails

f2fs: fix to off-by-one issue in f2fs_zero_post_eof_page()

f2fs: fix to zero post-EOF data when extending file size

f2fs: reject overlapping move range after len expansion

f2fs: return symlink writeback errors

f2fs: return writeback error from collapse range

f2fs: use the mount idmap for the owner check in f2fs_xattr_advise_set()

fanotify: report full event length for FIONREAD

fat: release buffer head after rebuilding parent

fat: restore original value when fat_ent_write failed

fbdev: kyro: Validate overlay viewport coordinates

fbdev: omapfb: panel-dsi-cm: initialize lock before registering display

fbdev: pvr2fb: correct user pointer annotation and sentinel initializer

fbdev: ssd1307fb: defer I2C transfers from damage callbacks

fbdev: tdfxfb: fix PCI enable cleanup with pcim_enable_device()

fbdev: uvesafb: unregister connector callback on init failure

firmware: arm_scmi: Add multiple protocols registration support

firmware: arm_scmi: Avoid IDR updates while cleaning channels

firmware: arm_scmi: Drop handle on protocol bind failures

firmware: arm_scmi: Fix requested device removal race

firmware: arm_scmi: Free transport channel on IDR failure

firmware: arm_scmi: Protect device request lookup with RCU

firmware: arm_scmi: Reject out of range DT protocol IDs

firmware: arm_scmi: Roll back partial protocol table registration

firmware: arm_scmi: Unregister device notifier before IDR teardown

firmware: arm_scmi: Unrequest devices if driver registration fails

firmware: arm_scmi: Use channel ID for transport teardown

firmware: coreboot: Validate table bounds

firmware: google: Add bounds checks in coreboot_table_populate()

firmware_loader: do not queue completed sysfs fallback requests

forcedeth: fix off-by-one when saving/restoring non-PCI config space

forcedeth: stop the tx_timeout register dump past the requested window

fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write

fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration

fs/ntfs3: Add more checks in mi_enum_attr (part 2)

fs/ntfs3: bound page_lcns[] index by the log record

fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()

fs/ntfs3: fix integer overflow in MFT cluster validation

fs/ntfs3: fix KMSAN uninit-value in ni_create_attr_list

fs/ntfs3: fix out-of-bounds read in read_log_rec_buf()

fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init

fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()

fs/ntfs3: Mark inode as bad as soon as error detected in mi_enum_attr()

fs/ntfs3: reject out-of-range evcn in mi_enum_attr()

fs/ntfs3: reject restart table growth beyond U16_MAX entries

fs/ntfs3: validate dirty page table on log replay

fs/ntfs3: validate ef->size covers the record's name and value

fsnotify: Fix stale object mask after concurrent mark updates

fuse: check attributes staleness on fuse_iget()

fuse: check for NULL root inode in fuse_fill_super_submount

fuse: convert readdir to use folios

fuse: convert to new timestamp accessors

fuse: support folios in struct fuse_args_pages and fuse_copy_pages()

fuse: use FUSE_ROOT_ID in fuse_get_root_inode()

futex: Prevent rcuwait use-after-free during requeue PI

genirq/generic_chip: Introduce irq_domain_{alloc,remove}_generic_chips()

gpu: host1x: Avoid stack over-read in debug output helpers

gpu: host1x: Fix offset calculation in trace_write_gather

greybus: audio: bound the topology section sizes against the fetched size

gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free

hfsplus: validate thread record before delete key rebuild

HID: core: quiesce input in hid_hw_stop() to prevent use-after-free

HID: i2c-hid: Fix "(null)" output when reading report descriptor fails

HID: i2c-hid: Fold i2c_hid_execute_reset() into i2c_hid_hwreset()

HID: i2c-hid: goodix: Disable VDD on VDDIO enable failure

HID: i2c-hid: Move i2c_hid_finish_hwreset() to after reading the report-descriptor

HID: i2c-hid: Refactor _DSM helper and add i2c-hid-acpi-prp0001 driver

HID: i2c-hid: Revert to await reset ACK before reading report descriptor

HID: i2c-hid: Split i2c_hid_hwreset() in start() and finish() functions

HID: i2c-hid: Switch i2c_hid_parse() to goto style error handling

HID: lg4ff: validate report length before fixed offsets

HID: mcp2221: stop device IO before hid_hw_stop

HID: mcp2221: validate report size in mcp2221_raw_event()

HID: nintendo: Fix imu_timestamp_us double increment per report

HID: picolcd: clamp eeprom debugfs read to bytes actually received

HID: rmi: fix OOB access with undersized RMI reports

HID: roccat: bound device-supplied profile index

HID: roccat: free buffered reports when destroying device

HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature

HID: sensor: custom: Fix field sysfs group cleanup on failure

HID: synchronize input before cleaning up a failed probe

HID: wacom: validate report length in wacom_intuos_pro2_bt_irq

hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device

hugetlbfs: release subpool on fill_super failure

hwmon: (emc1403) Add support for EMC1428 and EMC1438.

hwmon: (emc1403) Add support for EMC1442

hwmon: (emc1403) Convert to with_info API

hwmon: (emc1403) Drop hysteresis for low limit temperature

hwmon: (emc1403) Rely on subsystem locking

hwmon: (emc1403) Support 11 bit accuracy

hwmon: (max6621) fix negative temperature offset and crit readings

hwmon: (max6621) fix temperature clamp range

hwrng: ks-sa - access private data via struct hwrng

hwrng: ks-sa - Fix runtime PM cleanup on registration failure

hwspinlock: propagate errno when registering single lock

hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start()

i2c: core: fix debugfs UAF on adapter removal

i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure

i2c: mux: Fix channel node leak on adapter add failure

i2c: ocores: Disable clock on failed resume

i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices

i3c: master: Fix device_register() error path

i3c: master: Fix info leak and UAF in device unregister path

i3c: master: svc: bound IBI payload to the requested max_payload_len

i3c: mipi-i3c-hci: Fix DAT/DCT entry sizes

i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode

i3c: mipi-i3c-hci: Fix number of DAT/DCT entries for HCI versions < 1.1

i3c: mipi-i3c-hci: Quieten initialization messages

i3c: mipi-i3c-hci: Refactor PIO register initialization

i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc()

IB/isert: delay the final Login Response until the session is registered

IB/isert: post the full-feature receive buffers after session registration

IB/isert: reject login PDUs declaring more data than was received

IB/isert: reject PDUs declaring more data than was received

ice: clear the default forwarding VSI rule when releasing a VSI

iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE

iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable

iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF

iio: chemical: sgp30: Handle IAQ thread creation failure

iio: dac: m62332: Fix regulator reference count imbalance

iio: gyro: mpu3050: fix sign of raw angular velocity readings

iio: light: cm32181: return zero after writing calibscale

iio: light: gp2ap002: Disable regulators on resume failure

iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes

iio: light: gp2ap002: re-enable irq if runtime suspend fails

iio: light: isl29028: return zero in write_raw() on success

iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem()

iio: light: opt4001: Fix power down clearing bits of the wrong register

iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask

iio: light: opt4001: Reject integration times with a non-zero seconds part

iio: light: tsl2583: return zero in write_raw() on success

iio: light: tsl2772: fix ALS calibscale readback

iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure

iio: pressure: dps310: fix NULL pointer dereference on ACPI probe

iio: pressure: mpl115: Fix runtime PM cleanup

iio: srf04: fix pm_runtime handling on probe error path

iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register()

ima: Check for ERR_PTR from dentry_path() in validate_hash_algo()

include/linux/list.h: mark list_add and __list_add as __always_inline

inetpeer: randomize RB-tree node comparison using SipHash

Input: aiptek - validate raw macro indices before updating state

interconnect: Fix use after free in icc_get() and of_icc_get_by_index()

iommu/amd: Add support for Hygon family 18h model 4h IOAPIC

iommu/amd: Fix false positive in SB IOAPIC IVRS validation

iommu/amd: Prevent SB IOAPIC from overriding IVRS validation errors

iommu/arm-smmu-v3: Convert to use atomic poll timeout

iommu/dma: Check atomic pool allocation result directly

iommu/mediatek-v1: Fix off-by-one in MT2701_LARB_NR_MAX

iommu/msm: Return -ENOMEM on memory allocation failure in probe

iommu/qcom: Fix inverted fault report check in qcom_iommu_fault()

iommu/qcom: Remove sysfs device on probe failure path

iommu/vt-d: Fix no_iommu to disable platform opt-in

iommu/vt-d: Fix UCTP context table slot when copying root entries

iommu/vt-d: Force requesting ACS when tboot is enabled

ip6_gre: fix hardware header length for NBMA tunnels

ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()

ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove

ipip: fix skb leak in collect_md mode when metadata_dst allocation fails

ipmi: ipmb: validate write message length

ipmi: si: Fix NULL pointer dereference after failed registration

ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu]

ipv4: start using dst_dev_rcu()

ipv6: use RCU iterator to dump route exceptions

ipvs: fix integer overflow in ftp helper port/address parsing

irqchip/gic-v3-its: Fix its node leak in gic_acpi_parse_madt_its()

irqchip/gic-v3-its: Fix memleak in its_probe_one()

irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc()

irqchip/renesas-irqc: Fix generic interrupt chip leak on remove

irqchip/renesas-rzg2l: Fix loss of interrupt

irqdomain: Add support for generic irq chips creation before publishing a domain

irqdomain: Handle additional domain flags in irq_domain_instantiate()

irqdomain: Handle domain hierarchy parent in irq_domain_instantiate()

irqdomain: Introduce init() and exit() hooks

irqdomain: Introduce irq_domain_free()

irqdomain: Introduce irq_domain_instantiate()

irqdomain: Make build work for CONFIG_GENERIC_IRQ_CHIP=n

isofs: fix out-of-bounds page array access on empty zisofs block

isofs: release zisofs block pointer buffer head

kasan: fix cache shrink race with CPU hotplug

kcsan: avoid unintended access checking in NMIs

kprobes: Protect kprobe_blacklist with RCU

kselftest/arm64: mte: Skip the hugetlb tests if MTE not supported on such mappings

kselftest/arm64: mte: Use the correct naming for tag check modes in check_hugetlb_options.c

ksm_tests: skip hugepage test when Transparent Hugepages are disabled

ksmbd: bound smb_check_perm_dacl() ACE walks by DACL size

ksmbd: disconnect on SMB3 decryption failure

ksmbd: do not advertise unimplemented CA support

ksmbd: Do not skip lock checks for single-byte ranges

ksmbd: fix durable reconnect error path file lifetime

ksmbd: fix overflow in dacloffset bounds check

ksmbd: fix use-after-free in smb2_open during durable reconnect

ksmbd: fix WARNING "do not call blocking ops when !TASK_RUNNING"

ksmbd: free preauth sessions on connection teardown

ksmbd: validate ipc response length before dereferencing its fields

kunit: tool: fix _list_tests filtering wrong variable when list has TAP prefix

KVM: nVMX: Always flush vpid02 on first use

KVM: nVMX: Service local TLB flushes on failed nested VM-Enter

KVM: s390: Fix length check __import_wp_info()

KVM: s390: Fix memory leak in guest debug handling

KVM: s390: Fix old_data leak in guest debug error path

KVM: s390: Free guest debug data on vcpu destroy

KVM: s390: pv: Fix rc/rrc offset for PVM_DUMP

KVM: s390: Restore sigset on error path

KVM: s390: Take srcu when importing watchpoint data

KVM: s390: Zero initialize irq in reinject_machine_check

KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock

landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation

leds: pca9532: Fix inverted GPIO output polarity

leds: pca9532: Fix phantom device registration on missing hardware

lib/string: fix memchr_inv() for large ranges

lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone

lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()

libbpf: Search /lib64 and /lib in resolve_full_path()

libceph: reject buckets with mismatched CRUSH ids

libceph: validate banner payload length

libceph: validate OSD extent maps before cursor advance

libnvdimm/labels: Bound the on-media label size before the shift

libnvdimm/labels: Prevent integer overflow in __nd_label_validate()

Linux: Linux 6.6.157

lockd: pin next file across nlm_inspect_file lock-drop

locking/lockdep: Fix NULL pointer dereference in __lock_set_class()

LoongArch: Avoid preempt count underflow without probe

LoongArch: Do not save/restore percpu base register in rethook trampoline

lwt_bpf: Restore reserved headroom after xmit program

m68k: Fix backtraces for non-running tasks

m68k: nfcon: Do not call console_is_registered() in nfcon_device()

mailbox/pcc: support mailbox management of the shared buffer

mailbox: pcc: Always map the shared memory communication address

mailbox: pcc: Fix command timeout due to missed interrupt

mailbox: qcom-ipcc: fix duplicate channel allocation across holes

mailbox: rockchip: disable pclk on probe failure and unbind

maple_tree: fix argument name in header

md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb

md/raid1: don't set array_frozen in raid1_takeover()

md/raid5-ppl: fix use-after-free in ppl_do_flush()

md/raid5: protect bitmap batch counters aka seq_flush/seq_write consistency

md/raid5: round bitmap stripes with sector division

md: avoid stale clone I/O accounting timestamps

md: do overflow check for sb->bblog_shift in super_1_load()

media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref

media: cec-pin: Fix event FIFO ordering

media: cec: core: Fix kmemleak due to missed rc_free_device() call

media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash

media: cec: Serialize exclusive follower delivery

media: cec: stm32: prevent out-of-bounds write on RX overflow

media: cedrus: fix memory leak in cedrus_init_ctrls()

media: cobalt: Avoid freeing ALSA private data twice

media: cx231xx: reject geometry changes while the VBI queue is busy

media: cx23885: cancel NetUP CI work before teardown

media: em28xx: defer audio-only extension registration

media: em28xx: fix use-after-free of dev_next->devlist on disconnect

media: go7007: defer the ALSA v4l2 put until card release

media: i2c: ov02a10: fix endpoint parsing use-after-free

media: i2c: ov7740: fix use-after-destroy in remove

media: i2c: rdacm21: Fix missing media_entity_cleanup()

media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define

media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define

media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common

media: nxp: imx8-isi: Correct color map between V4L2 and ISI

media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing

media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks

media: rc: sunxi-cir: Unregister rc device on probe failure

media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure

media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak

media: s2255: bound JPEG frame size before copying into the buffer

media: s2255: check firmware size before reading trailing marker

media: saa7164: fix cleanup on resource allocation failure

media: tda18250: fix possible integer overflow

media: usbtv: keep device alive while ALSA card exists

media: v4l2-async: avoid deleting unlinked ASC entry on link error

media: v4l2-async: Unregister sub-device if asc_list is empty

media: v4l2-ctrls: Allow unknown HDR10 white point and luminance

media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link

media: v4l: async: Drop useless list move operation

media: venus: fix payload size calculation in parse_raw_formats()

media: venus: fix payload size returned by parse_caps() and parse_alloc_mode()

media: vicodec: fix out-of-bounds write in FWHT encoder

media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure

media: vimc: fix pixel format lookup in enum_framesizes

media: zoran: Avoid freeing a registered video_device twice

mfd: iqs62x: Reject zero-length firmware records

mfd: rave-sp: validate received frame payload lengths

mfd: tps6594: Add register definitions for TI TPS65224 PMIC

MIPS: ptrace: Fix syscall skipping via PTRACE_SYSCALL

misc: ad525x_dpot: use driver core groups for sysfs files

misc: bcm-vk: Use acquire/release for msgq_inited

misc: rtsx: add missing write register handling

misc: rtsx_usb: avoid USB I/O in runtime autosuspend

misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe()

mlxbf-bootctl: fix the build error with FIELD_PREP()

mm/damon/core-kunit: check region count before testing in split_at()

mm/damon/core-kunit: handle region split failure in filter_out()

mm/damon/core: skip aging from repeated aggressive merging

mm/damon/paddr: drop last same folio access check reuse optimization

mm/damon/sysfs-schemes: kobject_del() scheme dirs

mm/damon/sysfs-schemes: kobject_del() scheme filter dirs

mm/damon/sysfs-schemes: kobject_del() scheme region dirs

mm/damon/sysfs: kobject_del() region and target (error) dirs

mm/damon/sysfs: kobject_del() target (normal), context and kdamond dirs

mm/damon/tests/core-kunit: catch test failure in test_merge_regions_of()

mm/damon/vaddr-kunit: check region count in three_regions test

mm/damon/vaddr: drop last same folio access check optimization

mm/hugetlb: fix missing migratable flag on same-node hugetlb migration

mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch()

mm/mm_init: fix incorrect node_spanned_pages

mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec()

mm: memcg: stop reclaim when a limit update is superseded

mmc: via-sdmmc: stop card-detect handling on probe failure

modpost: prevent leak when early return no suffix .o in read_symbols()

mpls: reload header after pskb_may_pull()

mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction

mtd: afs: validate v2 image info bounds

mtd: mtdoops: free page bitmap when the backing MTD is removed

mtd: mtdswap: Avoid freeing registered blktrans device twice

mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition()

mtd: rawnand: validate ONFI extended parameter page sections

net/iucv: filter frames in afiucv_hs_rcv() by ingress device

net/mlx5e: xsk: Fix unlocked writing to ICOSQ

net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads

net/rds: use wq_has_sleeper() in rds_cong_map_updated()

net/sched: act_skbmod: fix length calculations and avoid invalid header warnings

net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup

net/sched: cls_api: fix teardown of an adopted proto on insert-race loss

net/sched: fq_codel: clamp default quantum and mtu

net/sched: fq_pie: clamp default quantum to avoid signed overflow

net/sched: hhf: clamp quantum before hhf_change() to avoid overflow

net/sched: sch_codel: clamp default mtu to avoid disabling CoDel

net/sched: sch_htb: limit htb_classify inner-class filter hops

net/sched: sch_teql: restore skb->dev on the slave failure path

net/sched: sfq: clamp quantum to avoid signed overflow soft lockup

net/smc: do not dereference an unset send buffer on the SMC-D teardown path

net/smc: fix socket refcount leak in smc_switch_conns()

net/smc: fix use-after-free in smc_rx_pipe_buf_release()

net/smc: free pending qentry in smc_llc_flow_stop() before memset

net/smc: free stashed qentry before overwrite in REQ_ADD_LINK to ADD_LINK transition

net/smc: hash socket only after full initialisation in smc_sk_init()

net/smc: unregister the connection before draining the rx tasklet

net: Add MDB bulk deletion device operation

net: Add MDB get device operation

net: add missing ref_tracker_dir_exit() to net_passive_dec()

net: bridge: Reject descending VLAN tunnel ranges

net: bridge: vlan: fix inverted default vlan notification

net: cap advertised IP tunnel headroom

net: dsa: b53: fix error propagation from b53_fdb_dump()

net: dsa: mv88e6xxx: Fix PCS link check on CMODE read error

net: dst: add four helpers to annotate data-races around dst->dev

net: dst: introduce dst->dev_rcu

net: ethernet: sun4i-emac: Fix IRQ error handling

net: fec: only stop PTP if it was initialized

net: fix spurious TX timeout after dev_activate()

net: hns3: don't auto enable misc vector

net: hns3: fix kernel crash when 1588 is sent on HIP08 devices

net: hsr: enable promiscuous mode on interlink port with fwd offload

net: hsr: free learned nodes on device setup failure

net: hsr: init prune_proxy_timer sooner

net: hsr: must allocate more bytes for RedBox support

net: hsr: Provide RedBox support (HSR-SAN)

net: hsr: Use full string description when opening HSR network device

net: hsr: Use the seqnr lock for frames received via interlink port.

net: ipa: balance runtime PM reference on remove error

net: ipa: Convert to platform remove callback returning void

net: kcm: Hold RCU read lock while running BPF parser

net: libwx: fix Tx L4 checksum

net: ntb_netdev: Avoid double-accounting netif_rx() drops

net: ntb_netdev: Count packets dropped on RX refill failure

net: ntb_netdev: Fix TX busy and drop handling

net: openvswitch: fix flow mask use-after-free on flow deletion

net: openvswitch: fix kernel-doc warnings in internal headers

net: openvswitch: fix nf_connlabels leak in ovs_ct_init

net: qualcomm: rmnet: restore skb->dev on deaggregated frames

net: ravb: avoid dereferencing an invalid PTP clock

net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()

net: skbuff: don't touch shared zerocopy state in skb_tx_error()

net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering

net: stmmac: dwmac4: Account for the primary MAC address for UC filtering

net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering

net: stmmac: selftests: Account for the UC filter list for filtering tests

net: stmmac: selftests: Check multiple MMC counters

net: stmmac: selftests: Pass the IP proto mask in the TC selftest

net: thunderbolt: Count delivered packets in rx_packets and rx_bytes

net: thunderbolt: Mark the connection down when bringing it up fails

net: thunderbolt: Release the Rx HopID that was handed out on mismatch

net: tun: bound receive headroom

net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition

netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet

netfilter: nf_tables: move hardware offload step after building the chain blob

netfilter: nft_counter: serialize reset with spinlock

netfilter: x_tables: replace pr_{info,err}() by pr_info_ratelimited()

netfilter: xt_cgroup: Make it independent from net_cls

netfilter: xt_HL: add pr_fmt and checkentry validation

nfc: digital: Do not dump a NULL response in command completion

nfc: llcp: avoid userspace overflow on invalid optlen

nfc: llcp: bound SNL TLV parsing to the skb and add length checks

nfc: llcp: read llcp_sock->local under the socket lock in getsockopt

nfc: nci: fix double completion race in nci_data_exchange_complete

nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing

nfc: pn533: hold a reference to the request skb during send_frame

nfs: move the nfs4_data_server_cache into struct nfs_net

nfs: refactor pNFS functions using clear_and_wake_up_bit

nfs: replace atomic bitops sequence with clear_and_wake_up_bit helper

nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()

nfsd: add filehandle match check to nfsd4_delegreturn()

nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref

nfsd: check client ownership when cancelling a copy-notify stateid

NFSD: Encode only the status in NFS-ACL v2 GETACL error replies

nfsd: fix cpntf publish race in nfs4_init_cp_state

NFSD: Fix off-by-one in DRC bucket pruning limit

nfsd: fix version mismatch loops in nfsd_acl_init_request()

nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget

nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo

nfsd: gate nfs2 setacl by argp->mask

nfsd: gate nfs3 setacl by argp->mask

nfsd: initialize copy-notify stateid before publishing it

NFSD: Prevent lock owner use-after-free during client teardown

nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE

nfsd: reject reclaim LOCK after RECLAIM_COMPLETE

nfsd: release path refs on follow_down() error

NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check

nfsd: Reset write verifier when async COPY writeback fails

NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock

nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types

nfsd: revoke copy-notify stateids before dropping their reference

nfsd: sample writeback error cursor before async COPY loop

nfsd: validate symlink target length in NFSv4 CREATE

NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path

NFSv4.2: fix LAYOUTSTATS send buffer exhaustion

NFSv4/pnfs: key the data server cache on the NFS version

NFSv4: remove callback IDR entry on client allocation failure

nilfs2: add nilfs_end_folio_io()

nilfs2: convert nilfs_btnode_commit_change_key to use a folio

nilfs2: convert nilfs_btnode_prepare_change_key to use a folio

nilfs2: convert nilfs_forget_buffer to use a folio

nilfs2: convert nilfs_page_bug() to nilfs_folio_bug()

nilfs2: convert to nilfs_folio_buffers_clean()

nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch

nilfs2: fix infinite loop in nilfs_clean_segments()

nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation

nilfs2: prevent out-of-bounds read in super root block parsing

nouveau/gem: reserve the bo in the info ioctl around the vma lookup

NTB: ntb_transport: Fail TX enqueue when the QP link is down

NTB: ntb_transport: Recycle TX entries before client callbacks

NTB: ntb_transport: Reject oversized TX buffers

null_blk: add configfs variable shared_tags

null_blk: free global tag_set on init error path

null_blk: register configfs subsystem after creating default devices

null_blk: reject per-device queue resize for shared tag set

null_blk: serialize configfs attribute stores with the lock

null_blk: serialize configfs attribute updates with device setup

null_blk: use DEFINE_MUTEX for the file-scope mutex

nvdimm/btt: reject an arena whose nfree is below the lane count

nvme-apple: Destroy the admin queue on removal

nvme-apple: Don't set a DMA direction for commands without a data transfer

nvme-apple: Drop the PRP null check chicken bit

nvme-apple: Never set the opcode in the NVMMU TCB

nvme-apple: Prevent shared tags across queues on Apple A11

nvme-apple: Reset q->sq_tail during queue init

nvme-apple: Use acquire/release for queue enabled state

nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request

nvme-pci: disable controller on admin queue IRQ setup failure

nvme-tcp: check the data direction of a C2HData PDU

nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone

nvme-tcp: fix host memory disclosure on R2T for a read command

nvme-tcp: reject a read that transferred too few bytes

nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()

nvme: add reservation command's defines

nvme: Add the DHCHAP maximum HD IDs

nvme: apple: Add Apple A11 support

nvme: introduce change ptpl and iekey definition

nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path

nvme: reject passthrough of driver-managed Set Features

nvme: target: rdma: fix ndev refcount leak on queue connect

nvme: zero the discard fallback page

nvmet-auth: Synchronize timeout work during SQ teardown

nvmet-rdma: avoid circular locking dependency on install_queue()

nvmet-rdma: factor out response resource cleanup

nvmet-rdma: fix queue leak when connect backlog is exceeded

nvmet-rdma: fix response resource leak on queue teardown

nvmet-rdma: use sbitmap to replace rsp free list

nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU

nvmet-tcp: reject unsolicited H2CData PDUs

nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()

nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns()

ocfs2: always run deallocs on copy-on-write completion

ocfs2: bound namelen in dlm_migrate_request_handler

ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item

ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin()

ocfs2: cluster: fix o2hb_dependent_users leak on pin failure

ocfs2: fix circular locking dependency in ocfs2_init_acl()

ocfs2: fix readdir position truncation on 32-bit kernels

ocfs2: synchronize heartbeat callbacks with o2net teardown

ocfs2: validate lengths in dlm_mig_lockres_handler

ocfs2: validate rl_used against rl_count in refcount block validator

octeontx2-af: Fix TL3/TL2 link config ENA clearing

octeontx2-af: initialize lmac_bmap in rvu_mcs_set_lmac_bmap()

of: fix out-of-bounds read in of_alias_scan() stem parser

of: property: add missing kerneldoc for of_graph_get_endpoint_count()

of: property: add of_graph_get_next_port()

of: property: add of_graph_get_next_port_endpoint()

of: property: use unsigned int return on of_graph_get_endpoint_count()

openrisc: fix arbitrary kernel memory access via or1k_atomic syscall

openvswitch: Fix CT limit teardown use-after-free

openvswitch: only skb_tx_error() a packet we are about to drop

orangefs: fix double-free of trailer_buf on readdir copy failure

orangefs: skip leading spaces before parsing client debug masks

parisc: eisa: Fix infinite loop when parsing invalid IRQ value

parisc: Fix alignment of asm statements in head.S

parse_longname(): strrchr() expects NUL-terminated string

PCI/MSI: Enable memory decoding before restoring MSI-X messages

PCI/proc: Avoid spurious runtime PM wakeup on config space accesses

PCI/proc: Use file_ns_capable() when checking config space read access

PCI/proc: Warn on writes to kernel-exclusive config space regions

PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses

PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608]

PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk

PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip

PCI: j721e: Fix incorrect max_lanes for J7200

PCI: meson: Fix GPIO state while requesting PERST#

PCI: xgene: Drop unnecessary OF node reference

PCI: xgene: Drop XGENE_PCIE_IP_VER_UNKN

perf auxtrace: Fix queue grow overflow and old array leak

perf cs-etm: Avoid truncating AUX buffer sizes to int

perf cs-etm: Create decoders after both AUX and HW_ID search passes

perf cs-etm: Fix incorrect or missing decoder for raw trace

perf cs-etm: Fix thread leaks on trace queue init failure

perf cs-etm: Flush thread stacks after decoder reset

perf cs-etm: Queue context packets for frontend

perf data convert json: Fix trace_seq memory leak in process_sample_event()

perf dso: Guard against cache underflow on short reads in dso_cache__memcpy()

perf dso: Guard close() against invalid fd in dso__decompress_kmodule_path()

perf intel-bts: Fix off-by-one in auxtrace_info minimum size check

perf intel-pt: Fix off-by-one in auxtrace_info minimum size check

perf jevents: Add more components to the metric sorting order

perf machine: Check snprintf truncation for guest kallsyms path

perf machine: Check snprintf truncation in machines__findnew()

perf machine: Don't abort guest map creation on first inaccessible dir

perf machine: Fix NULL parent dereference in fork event processing

perf machine: Free scandir entries in guest kernel map creation

perf machine: Guard against NULL strlist in machines__findnew()

perf machine: Reset errno before strtol in guest kernel map creation

perf machine: Use snprintf() for guestmount path construction

perf metricgroup: Fix metric expression copy leaks

perf sched: Fix register_pid() overflow, strcpy, and BUG_ON

perf stat: Fix evsel_list leak in cmd_stat

perf synthetic-events: Fix divide by zero in perf_event__synthesize_threads

perf synthetic-events: Fix uninitialized pthread_join

perf test all metrics: Fully ignore Default metric failures

perf test bpf-counters: Add test for BPF event modifier

perf test metrics: Update all metrics for possibly failing default metrics

perf test stat_all_metrics: Ensure missing events fail test

perf test stat_bpf_counter.sh: Stabilize the test results

perf test: Do not skip when some metrics tests succeeded

perf test: Fix perf stat --bpf-counters on hybrid machines

perf test: raise limit to 20 percent for perf_stat_--bpf-counters_test

perf test: Simplify metric value validation test final report

perf test: Update all metrics test like metricgroups test

perf test: Use sqrtloop workload to test bperf event

perf tests metrics: Permission related fixes

perf tests: Fix flakiness in BPF counters test on hybrid systems

perf tests: Skip metrics validation if system-wide recording lacks permission

perf thread-stack: Fix heap buffer overflow on branch stack wrap copy

perf trace-event: Fix buffer overflow in read_string()

perf trace-event: Fix integer truncation in do_read() and skip()

perf ui hists: Fix uninitialized stack memory free on pstack allocation failure

perf/cxlpmu: Fix 64-bit write to 32-bit HDM filter register

perf/x86/amd/uncore: Add group validation

perf/x86/amd/uncore: Fix the return value of amd_uncore_df_event_init() on error

perf/x86/amd/uncore: Refactor uncore management

perf/x86/intel/uncore: Fix die ID init and look up bugs

perf/x86/intel/uncore: Keep PCI PMUs working when MMIO/MSR setup fails

perf/x86/intel: Fix kernel address leakages in LBR stack

perf: arm_spe: Make wakeup range check overflow safe

phonet: pep: do not write beyond optlen in getsockopt

phy: qcom-sgmii-eth: relax order of .power_on() vs .set_mode*()

phy: qcom: qmp-combo: Correct pre-emphasis table for QMP v4 DP PHYs

phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend

phy: qcom: qmp-usb: Fix possible NULL-deref on early runtime suspend

phy: qcom: sgmii-eth: vote for both voltage rails with correct current loads

phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend

phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table

phy: starfive: Fix runtime PM cleanup in JH7110 DPHY RX probe

phy: sunplus: fix error handling in sp_uphy_init()

pinctrl: bcm2835: Don't remove an unregistered GPIO chip

pinctrl: mediatek: Add EINT support for multiple addresses

pinctrl: mediatek: common-v1: Fix EINT breakage on older controllers

pinctrl: mediatek: common-v1: Fix error checking in mtk_eint_init()

pinctrl: mediatek: eint: Drop base from mtk_eint_chip_write_mask()

pinctrl: mediatek: eint: Fix invalid pointer dereference for v1 platforms

pinctrl: mediatek: Fix new design debounce issue

pinctrl: mediatek: Fix the invalid conditions

pinctrl: mediatek: free EINT resources on unbind

pinctrl: mediatek: Use C99 initializers in PINCTRL_PIN_GROUP()

pinctrl: rockchip: Reset the pin count when recalculating SoC data

platform/chrome: cros_ec_debugfs: Clean up console log on probe failure

platform/chrome: cros_ec_debugfs: Unregister panic notifier

platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count

platform/chrome: sensorhub: Bound the EC-reported sensor number

platform/chrome: sensorhub: Fix dropped timestamp events and log spam

platform/chrome: sensorhub: Fix memory overread in ring handler

platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL

platform/surface: acpi-notify: Check ACPI companion before use

platform/x86: dell-privacy: Fix race condition

platform/x86: dell-wmi-base: Fix resource leak on module load failure

platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer

platform/x86: dell-wmi-sysman: Fix instance ID bounds

platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS

platform/x86: hp-bioscfg: advance elem past consumed array elements

platform/x86: hp-bioscfg: bound ordered-list parsing by the package count

platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store()

platform/x86: hp-bioscfg: fix heap OOB read on empty password write

platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password

platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer()

platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed

platform/x86: hp-bioscfg: fix password encoding bounds check

platform/x86: hp-bioscfg: pass validated element count to package parsers

platform/x86: hp-bioscfg: warn on element type mismatch instead of failing

platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path

platform/x86: ISST: Just allow 2 bits for SST feature enable

platform/x86: ISST: Validate level in perf mask ioctls

platform/x86: ISST: Validate logical CPU id and clos id

platform/x86: ISST: Validate socket ID in clos_assoc ioctl

PM: hibernate: Fix memory leak in snapshot_write_next() error path

PM: sleep: Fix off-by-one in wakelocks number limit check

pmdomain: bcm: bcm2835: handle genpd provider registration errors

power: supply: bd99954: Drop bad register fields

power: supply: bq24257: fix use-after-free on remove

power: supply: bq256xx: drain usb_work before freeing the charger

power: supply: bq25890: Fix power_supply reference leak

power: supply: bq27xxx: bq27520g4: fix REG_TTES address

power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address

power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address

power: supply: cros_usbpd-charger: bound the EC-reported port count

power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS

power: supply: isp1704_charger: cancel work on remove

power: supply: lp8727: fix use-after-free in lp8727_release_irq()

power: supply: max17040: drop incorrect I2C functionality check

power: supply: max17040: synchronize work cancellation on suspend

power: supply: qcom_battmgr: terminate the strings from firmware

power: supply: rt9455: quiesce delayed work before teardown

power: supply: sbs-battery: Use a per-device serial number buffer

power: supply: sc2731_charger: cancel work on remove

power: supply: sc2731_charger: Convert to platform remove callback returning void

power: supply: twl4030_charger: cancel workers via devm

power: supply: ucs1002: fix use-after-free on remove

powerpc/configs: enable CONFIG_RAS to fix EDAC support

powerpc/crash: stop watchdogs before booting kdump kernel

powerpc/irq: Fix missing r2 clobber in PCREL inline assembly

powerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population

powerpc/powermac: fix OF node refcount

powerpc/pseries/iommu: switch to Default DMA window during kdump

powerpc/pseries: Handle and log pseries-wdt registration failures

powerpc/pseries: Move H_WATCHDOG definitions to a common header

powerpc/smp: add NULL guard for cause_ipi in smp_muxed_ipi_message_pass

ppdev: prevent overflow when setting port timeout

pppox: drain queued packets on channel handoff

pps-gpio: remove dead capture_clear code

pps: clients: gpio: Bypass edge's direction check when not needed

pps: don't try to wait for negative timeouts in PPS_FETCH

pps: pps-gpio: split IRQ handler into hardirq timestamper + threaded handler

prctl: fix PR_SET_MM_AUXV losing the forced AT_NULL terminator

qede: Fix NULL pointer dereference in TPA fragment processing

rapidio: clear mport->net when rio_add_net() fails

rapidio: mport_cdev: fix use-after-free in dma_req_free()

rcu: Mark accesses to ->rcu_urgent_qs and ->rcu_need_heavy_qs

rcu: Remove unused function declaration rcu_eqs_special_set()

rcu: Rename rcu_momentary_dyntick_idle() into rcu_momentary_eqs()

RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap

RDMA/cma: Fix WARNING in res_to_rt

RDMA/core: Add an option to display driver-specific QPs in the rdmatool

RDMA/core: Add driver APIs pre_destroy_cq() and post_destroy_cq()

RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations

RDMA/core: Add support to set privileged QKEY parameter

RDMA/core: Fix potential use after free in counter_release()

RDMA/core: Fix potential use after free in ib_dealloc_pd_user()

RDMA/core: Fix potential use after free in ib_destroy_cq_user()

RDMA/core: Fix potential use after free in ib_destroy_srq_user()

RDMA/core: Fix potential use after free in ib_free_cq()

RDMA/core: Fix use after free in ib_query_qp()

RDMA/core: Wait for RCU callbacks before unloading ib_core

RDMA/cxgb4: Cancel reg_work before freeing device on remove

RDMA/cxgb4: Free debugfs on registration failure

RDMA/cxgb4: free STAG index when TPT entry write fails

RDMA/efa: Fix PBL chunk length computation

RDMA/erdma: Fix CEQ tasklet use-after-free on removal

RDMA/erdma: Hold CQ references when processing EQ events

RDMA/erdma: restrict the driver to little-endian systems

RDMA/hfi1: Create workqueues before device initialization

RDMA/hfi1: Free RX data on late probe failure

RDMA/hfi1: Initialize debugfs after probe completes

RDMA/hfi1: Preserve unit 0 on allocation failure

RDMA/hfi1: Propagate sdma_txinit_ahg() errors

RDMA/hfi1: Remove redundant PCI device ID validation

RDMA/hfi1: Stop flushing the global IB workqueue

RDMA/ipoib: Drain RCU callbacks during module teardown

RDMA/mlx5: Drain RCU callbacks during module teardown

RDMA/mlx5: Fix integer overflow of user QP buffer size

RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs

RDMA/mlx5: Send cong param changes to the resolved port mdev

RDMA/nldev: Fix locking when accessing mr->pd

RDMA/nldev: validate dynamic counter attribute length

RDMA/restrack: Fix typos in the comments

RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state

RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[]

RDMA/siw: Fix use-after-free in siw_accept()

RDMA/siw: Introduce siw_free_cm_id

RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ

RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters

RDMA/srpt: Pass the mapped task attribute to target_init_cmd()

RDMA/ucma: Allow path records to exactly fit the output buffer

RDMA/ucma: Lock the handler in ucma_set_ib_path()

regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer

regulator: core: use system_freezable_wq for init complete work

regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata

regulator: qcom-refgen: correct the regulator type to CURRENT

regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling

regulator: tps6594-regulator: Add TI TPS65224 PMIC regulators

regulator: tps6594-regulator: Constify struct tps6594_regulator_irq_type

regulator: tps6594-regulator: Fix the number of irqs for TPS65224 and TPS6594

regulator: tps6594-regulator: refactor variant descriptions

regulator: tps6594-regulator: remove hardcoded buck config

regulator: tps6594-regulator: remove interrupt_count

regulator: tps6594: Fix device node reference leaks in multiphase loop

remoteproc: Allow shutdown of crashed processors

remoteproc: core: Attach rproc asynchronously in rproc_add() path via schedule_work()

remoteproc: core: Drop redundant initialization of 'ret' in rproc_shutdown()

remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry()

remoteproc: Move resource table data structure to its own header

remoteproc: Prevent crash handling to race with rproc_del()

remoteproc: qcom: Fix glink->node reference leak in qcom_add_glink_subdev

remoteproc: qcom_q6v5_adsp: Fix reference leak for device node

remoteproc: scp: Fix device reference leak on failed lookup

remoteproc: use rsc_table_for_each_entry() in rproc_handle_resources()

Revert "arm64: mm: Don't remap pgtables for allocate vs populate"

Revert "irqchip/mbigen: Fix mbigen node address layout"

Revert "mailbox/pcc: support mailbox management of the shared buffer"

Revert "media: v4l2-dev: fix error handling in __video_register_device()"

riscv: cpufeature: Clarify ISA spec version for canonical order

rpmsg: glink: fix deadlock in endpoint destroy during driver detach

rpmsg: glink: remove duplicate code for rpmsg device remove

rpmsg: glink: smem: order FIFO read after availability check

rtc: gamecube: check return value of devm_rtc_register_device()

rtc: pcf85363: Add error checking to regmap calls in probe()

rtc: pcf8563: fix clock provider leak on unbind

rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers

rtc: rzn1: Fix weekday underflow when alarm crosses month boundary

rtc: zynqmp: Return optional clock lookup errors

s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks

s390/dasd: Do not complete a failed ESE read as successful

s390/dasd: Guard sysfs discipline callbacks against unallocated private data

s390/dasd: Propagate partial completion length across ERP recovery

s390/debug: Fix deadlock during unregister

s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove

s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL

s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed

s390/vfio-ap: Fix NULL deref in status_show() during queue probe

s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap

s390/vfio-ap: Fix required lock not held during update of ap_matrix_mdev object

s390/vfio-ap: Fix stale do_remove flag across iterations in vfio_ap_mdev_cfg_remove

s390/vfio-ap: fix stale pqap_hook pointer on error in vfio_ap_mdev_set_kvm()

samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-modify

samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify

sched/fair: Check CPU capacity before comparing group types during load balance

sched/fair: Fix overflow in update_tg_cfs_runnable()

scripts/tags.sh: Prevent binary files appearing in cscope.files

scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables()

scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers

scsi: pm8001: Use rollback index when freeing MSI-X vectors

scsi: qla2xxx: Avoid double completion in async IOCB timeout

scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry()

scsi: qla2xxx: Bound i2c->length in I2C bsg handlers

scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions()

scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read

scsi: qla2xxx: Check entry_status in qla24xx_modify_vp_config()

scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation

scsi: qla2xxx: Don't query firmware state while chip is down

scsi: qla2xxx: Drop vport reference under lock in report ID acquisition

scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check

scsi: qla2xxx: Fix an loop timeout test

scsi: qla2xxx: Fix cs84xx use-after-free on host teardown

scsi: qla2xxx: Fix FCE trace enable parsing in debugfs

scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump

scsi: qla2xxx: Fix Name Server logout detection on FWI2 adapters

scsi: qla2xxx: Fix NVMe abort reference leak on repeated abort

scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb()

scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject

scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()

scsi: qla2xxx: Hold vport_slock for host map update in report ID acquisition

scsi: qla2xxx: Initialize NVMe abort_work once at submission

scsi: qla2xxx: Quiesce response IRQ before freeing request queue

scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path

scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path

scsi: qla2xxx: Serialize flash version read in reset handler

scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started

scsi: qla2xxx: Use coherent DMA buffer for D_Port diagnostics

scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state()

scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers

scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak

scsi: sd: Fix sd_done() sense handling condition

scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches.

scsi: target: iscsi: Reserve a terminator byte for the login payload

scsi: ufs: core: Remove redundant host_lock calls around UTMRLDBR

scsi: ufs: core: Remove unnecessary wmb() after ringing doorbell

scsi: ufs: core: Set task state before io_schedule_timeout()

scsi: ufs: debugfs: Reserve space for a string terminator

sctp: distinguish sequence zero from wildcard in reconf lookup

sctp: drop a chunk if its transport was removed

sctp: fix NULL deref on untransmitted RECONF completion

sctp: fix stream->outcnt underflow on duplicate RECONF responses

sctp: stop processing a packet once its association is deleted

seg6: reset IP6CB after IPv6 decapsulation

selftests/arm64: Print missing MTE TAP headers

selftests/arm64: Treat KSM merge_across_nodes as optional

selftests/bpf: Add description for running vmtest on RV64

selftests/bpf: Fix for veristat file/prog filters processing

selftests/bpf: Fix incorrect error checking for pthread_create

selftests/bpf: Fix memory leak in msg_alloc_iov

selftests/bpf: Fix memory leak in msg_alloc_iov error path

selftests/bpf: Fix memory leak on subtest_states reallocation

selftests/bpf: Limit URLS parsing logic to actual scope in vmtest

selftests/bpf: Silence array bounds warning in global_map_resize

selftests/bpf: Support local rootfs image for vmtest

selftests/bpf: vmtest.sh: Preserve command quoting when running in the VM

selftests/mm/cow: generalize do_run_with_thp() helper

selftests/mm/cow: modify the incorrect checking parameters

selftests/mm/khugepaged: enlighten for multi-size THP

selftests/mm/kugepaged: restore thp settings at exit

selftests/mm: add new test cases to the migration test

selftests/mm: factor out thp settings management

selftests/mm: fix ksm NUMA merge test for systems with memoryless NUMA nodes

selftests/mm: fix ternary operator precedence in ksm_tests

selftests/mm: ksm_tests: use kselftest framework

selftests/mm: report unique test names for each cow test

selftests/mm: skip COW tmpfile cases when fallocate() is unsupported

selftests/mm: support multi-size THP interface in thp_settings

selftests/rseq: Replace glibc-specific __GNUC_PREREQ with portable check

selftests/zram: fix kernel_gte() for POSIX sh

selftests: arm64: add hugetlb mte tests

selftests: mm: cow: flag vmsplice() hugetlb tests as XFAIL

selftests: mm: support shmem mTHP collapse testing

selftests: timers: leap-a-day: Fix -w option and update usage comment

serial: amba-pl011: unprepare console clock on unregister

serial: ma35d1: Fix OF node reference leaks in console init

signal: avoid shared siginfo namespace rewrites

slip: fix use-after-free in sl_sync()

slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()

smack: deduplicate smackfs/{direct,mapped} file_operations

smack: fix cred UAF in smack_file_send_sigiotask()

smack: fix incorrect task context in smack_msg_queue_msgrcv

smack: restrict smackfs/{direct,mapped} values to 0-255

smack: simplify write handlers of sysfs entries

smb/server: fix invalid pointer dereference in ksmbd_stop_durable_scavenger()

smb/server: preserve error status in smb2_handle_negotiate()

smb: client: clear ce->tgthint in free_tgts()

smb: client: fix ALIGN() overflow in symlink_data() error context loop

smb: client: fix copy-paste error in WSL EA length accounting for $LXDEV

smb: client: fix request buffer leak in smb2_new_read_req()

smb: client: harden DFS cache against invalid target hints

smb: server: fix leak of ksmbd_ipc_login_request_ext() returned buffer

soc: fsl: qe: check platform_driver_register() in qe_ic_of_init()

soc: qcom: rpmh-rsc: manage PM notifiers with devres

soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap()

software node: Fix software_node_get_reference_args() with index -1

soundwire: qcom: Fix port exhaustion check in stream_alloc_ports

speakup: keyhelp: guard letter_offsets possible out-of-range indexing

spi: bcm63xx-hsspi: disable clocks on resume failure

spi: bcm63xx: disable clock on resume failure

spi: bcmbca-hsspi: disable clocks on resume failure

spi: davinci: switch to managed controller allocation

spi: davinci: Unset POWERDOWN bit when releasing resources

spi: davinci: Use helper function devm_clk_get_enabled()

spi: img-spfi: don't disable runtime PM on DMA deferred probe

spi: sprd-adi: Fix probe succeeding without registering the controller

Squashfs: check block offset is not negative

staging: fbtft: Use sysfs_emit_at() to print to sysfs file

staging: greybus: audio: correct sscanf() return value check

staging: greybus: hid: fix SET_REPORT return value

staging: media: tegra-video: fix of_node_put() on VIP parse errors

staging: media: tegra-video: vi: fix probe failure on skipped last port

staging: octeon: add missing napi_disable in cvm_oct_rx_shutdown

staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown

staging: octeon: ethernet-mem: replace pr_warn with dev_warn in free functions

staging: octeon: fix free_irq dev_id mismatch in cvm_oct_rx_shutdown

staging: octeon: replace pr_warn with dev_warn in fill and rx paths

staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()

staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr()

staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()

staging: rtl8723bs: use kfree_sensitive() for key material

staging: sm750fb: gate dualview dataflow using g_dualview

sticon/parisc: Detect default STI graphics card for console output

SUNRPC: always drain cache_cleaner before destroying a cache_detail

SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6

SUNRPC: Check svc pool percpu counter allocation

SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat

SUNRPC: harden gss_krb5_unwrap_v2 against short tokens

SUNRPC: harden gss_unwrap_resp_priv length checks

sunrpc: init gssp_lock before publishing proc entry

SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field

sunrpc: route to a populated pool in svc_pool_for_cpu()

SUNRPC: svcauth_gss: enforce krb5 token minimum length

SUNRPC: wait for in-flight client TLS handshake callback

SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow

sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE

SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry

svcrdma: Fix offset arithmetic in read_chunk_range

svcrdma: Fix pcl_for_each_segment for empty chunks

swiotlb: Preserve allocation virtual address for dynamic pools

taskstats: fix cpumask parsing cutting off the last character

tcp: clear sock_ops cb flags before force-closing a child socket

tcp: fix corruption of urgent data on multi-segment retransmit

tcp: fix potential race in tcp_v6_syn_recv_sock()

thermal/drivers/imx: Disable clock on runtime resume failure

thermal/drivers/qoriq: Disable clock on resume failure

thermal/drivers/rcar: Fix error checking in probe()

thermal: intel: int3400: clean up ODVP on probe failures

timekeeping: Account for monotonicity adjustment in ntp_error

timer: Keep debugobjects state consistent in migrate_timer_list()

timers/itimer: Zero-init old itimerval before copy to userspace

tls: fix RX desync on overlapping skbs

tools/bpf/bpftool: Reset vmlinux BTF after map commands

tools/bpf/bpftool: Reset vmlinux BTF after struct_ops commands

tools/build: Add bpftool-skeletons feature test

tools/build: Allow versioning of all LLVM tools defined in Makefile.include

tools/build: Use SYSTEM_BPFTOOL for system bpftool

tools/compiler: match glibc 2.42 definition of __attribute_const__

tools/nolibc/powerpc: mark ctr and xer as clobbered by system call

tpm: st33zp24: Return zero on status read failure

tpm: st33zp24: Validate locality read result

tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout

tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions

tracing/mmiotrace: Remove reference to unused per CPU data pointer

tracing/user_events: Clear copied tracing state before fork duplication

tracing: Fix crash passing ERR_PTR to kthread_stop()

tracing: Fix use-after-free with same-name named triggers

tracing: Have trace_event_update_all() only handle module that is loading

tracing: Remove "__attribute__()" from the type field of event format

tty: clear cdev pointer after cdev_add() failure

tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64

tty: ipoctal: convert to u8 and size_t

ubi: fastmap: Add module parameter to control reserving filling pool PEBs

ubi: fastmap: Allocate memory with GFP_NOFS in ubi_update_fastmap

ubi: fastmap: erase_block: Get erase counter from wl_entry rather than flash

ubi: fastmap: Fix lapsed wear leveling for first 64 PEBs

ubi: fastmap: Fix missed ec updating after erasing old fastmap data block

UBI: fastmap: Pass to_be_tortured when reusing old fastmap PEBs

ubi: fastmap: Wait until there are enough free PEBs before filling pools

ubi: Fix rollback for explicit UBI device numbers

UBI: fix two issues in the ubi.mtd MODULE_PARM_DESC

UBI: Preserve torture flag when rescheduling failed erasures

ubi: Replace erase_block() with sync_erase()

ubifs: fix out-of-bounds read in signature length check

ublk: check for ublk_unmap_io() returning 0

ublk: clear VM_MAYWRITE on read-only ublk char device mmap

Linux: UDF symlink pathComponent header OOB read

udf: Fix i_lenExtents truncation on 32-bit kernels

udf: Mark LVID buffer as uptodate before marking it dirty

udf: reject VAT indexes equal to the entry count

uio: Fix stale info pointer in failed registration path

usb-storage: ene_ub6250: fix race between scan work and probe

usb: atm: usbatm: fix invalid ci_range initialization

USB: core: Use device_driver directly in struct usb_driver and usb_device_driver

usb: dwc2: gadget: Exit partial power down state when changing USB pull-up

usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns()

usb: fix UAF when probe runs concurrent to dyn ID removal

usb: gadget: aspeed_udc: check endpoint DMA allocation

usb: gadget: aspeed_udc: Convert to platform remove callback returning void

usb: gadget: configfs: fix out-of-bounds read of qw_sign

usb: gadget: f_fs: Prevent deadlock during ep0 read loop

usb: gadget: f_midi2: fix use-after-free in string attribute show path

usb: gadget: f_tcm: fix deadlock in usbg_make_tpg()

usb: gadget: f_uac1_legacy: remove broken string configfs attributes

USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()

usb: gadget: fix null pointer dereference in usb_put_function_instance()

usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs

usb: gadget: midi2: remove default configfs groups on teardown

usb: gadget: r8a66597: avoid double free of ep0_req in probe error path

usb: gadget: snps_udc_plat: clean up PHY on probe deferral

usb: gadget: u_audio: Fix use-after-free on sound card disconnect

usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()

usb: image: mdc800: change kmalloc() to kzalloc()

USB: make single lock for all usb dynamic id lists

USB: make to_usb_driver() use container_of_const()

usb: mtu3: allow system suspend during active gadget connection

USB: phy: fsl-usb: fix missing static keywords

usb: renesas_usbhs: Fix power-off ordering on unbind

usb: typec: qcom-pmic: cancel reset_work on stop

usb: typec: ucsi: displayport: Fix OOB altmode array index

usb: typec: ucsi: unregister debugfs entries on teardown

usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion

vdpa/mlx5: fix wrong list iterated in add_direct_chain error path

vdpa_sim: fix cleanup after worker creation failure

vfio/pci: clear vdev->msi_perm after freeing it on init failure

virtio-net: Ensure that TCP packets don't overflow gso_segs

virtio_balloon: disable indirect descriptors

vsock/virtio: flush works in dependency order

vsock: use sock_error() to consume sk_err after a failed connect

vxlan: mdb: Add MDB bulk deletion support

vxlan: mdb: Add MDB get support

vxlan: mdb: Adjust function arguments

vxlan: mdb: Factor out a helper for remote entry size calculation

vxlan: mdb: Fix use-after-free in vxlan_mdb_flush()

vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes

w1: ds2482: Fix signedness bug in ds2482_w1_triplet()

w1: ds28e17: reject an oversize length on an I2C block read

wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump

wifi: ath11k: add firmware-2.bin support

wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx()

wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate

wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path

wifi: ath11k: Correctly copy the hint BSSID in WMI scan request

wifi: ath11k: Fix error handling in ath11k_wmi_p2p_noa_event()

wifi: ath11k: fix leak in ath11k_service_ready_ext_event()

wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load()

wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event()

wifi: ath11k: implement handling of P2P NoA event

wifi: ath11k: qmi: refactor ath11k_qmi_m3_load()

wifi: ath11k: refactor ath11k_wmi_tlv_parse_alloc()

wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx()

wifi: ath12k: Correctly copy the hint BSSID in WMI scan request

wifi: ath6kl: avoid buffer overreads in WMI event handlers

wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets

wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control()

wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs

wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments

wifi: iwlwifi: mei: add support for SAP version 4

wifi: iwlwifi: mei: check SAP message length before reading it

wifi: iwlwifi: mei: pass correct argument to function

wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser

wifi: mac80211: send TWT teardown to peer after setup TX failure

wifi: mac80211: skip default WMM setup for AP_VLAN links

wifi: mac80211: skip unused probe response countdown offsets

wifi: mac80211_hwsim: avoid NULL skb in stop queue drain

wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex

wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length

wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss

wifi: mt76: mt7915: fix chainmask handling for non-dbdc phys on band 1

wifi: mt76: mt7915: fix double hif2 init on the non-WED path

wifi: mt76: mt7915: fix ext PHY use-after-free on register error path

wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986

wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie

wifi: mt76: mt7915: release hif2 reference on probe IRQ failure

wifi: mt76: mt7915: report RX chain signal for all RX paths

wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement

wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields

wifi: mt76: mt792x: Fix memory leak in SDIO TX path

wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config

wifi: mt76: mt7996: don't report a zero TX bitrate

wifi: mt76: mt7996: fix reg addr remap when addr is 0

wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV

wifi: mt76: mt7996: set MT76_MCU_RESET before waking MCU waiters on full reset

wifi: mt76: mt7996: validate default EEPROM firmware size

wifi: mwifiex: Detach sync cmd buffer on interrupted wait

wifi: rtl818x: initialize eeprom_93cx6 struct to zero

wifi: rtlwifi: pci: fix error path in rtl_pci_probe()

wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb()

wifi: rtw89: fix HE extended capability length check

wifi: zd1211rw: reject secondary interfaces to prevent conflicts

x86/cfi: Use symmetric SYM_START and SYM_END in __CFI_TYPE()

x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg()

x86/pkeys: Fix pkey_alloc() return value when pkeys are not supported

x86/tdx: Fix off-by-one in port I/O handling

x86/tdx: Fix zero-extension for 32-bit port I/O

xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc()

xdp: fix zero-copy frame layout

xenbus: Unregister reboot notifier on init failure

xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full

xfrm: Fix skb double-free in xfrm_dev_direct_output()

xhci: fix lost bounce buffers on TDs spanning several ring segments

xsk: avoid double checking against rx queue being full

xsk: fix NULL pointer dereference in __xsk_rcv()

xsk: Fix offset calculation in unaligned mode

xsk: Get rid of xdp_buff_xsk::orig_addr

y2038: uapi: Use 64-bit __kernel_old_timespec::tv_nsec on x32